feat: add repository profiles to issue resolver

[TheDarkniteFalls]

Description

Adds the deliberately narrow v0.3 repository-profile path requested in #145. load_repository_profile parses caller-fetched ISSUE_RESOLVER.md Markdown into generic ordered sections, labels its provenance, and exposes it as repository context that cannot override the constitution or grant authority.

The existing v0.2 workflow payloads remain unchanged when no profile is supplied. This PR also adds the profile standard, a Skillware dogfood profile, catalog and card updates, and durable frozen-v0.2 regression coverage.

Per the latest maintainer direction, smart section-to-stage mapping, checklist merging, compression, YAML, loader changes, network calls inside execute(), profile generation, and a prompt-injection firewall remain out of scope.

Acceptance mapping

• Caller-fetched Markdown parsing and provenance-labelled context: skill.py, manifest.yaml, and instructions.md
• No-profile compatibility: frozen upstream-v0.2 fingerprints and all-nine-stage regression coverage in test_skill.py
• Trust boundary and repository-admin responsibility: manifest.yaml, instructions.md, docs/contributing/issue_resolver_profile.md, and the root ISSUE_RESOLVER.md
• Public contracts, catalog, and UI metadata: docs/skills/issue_resolver.md, docs/skills/README.md, card.json, and its fixture
• Release notes: CHANGELOG.md

Verification

• python -m black --check . — 136 files unchanged
• flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics — 0 findings
• flake8 . --count --statistics — 0 findings
• pytest skills/ — 155 passed
• pytest tests/ — 175 passed
• python scripts/sync_extras.py --check — passed
• git diff --check — passed

The nested wheel-build test used existing local build tooling because the execution environment could not reach PyPI. The repository test was not modified or skipped and passed; CI can repeat it with normal isolated dependency installation.

Type of Change

• New Skill
• Skill Upgrade
• Bug Fix
• Documentation
• Framework Feature
• CLI
• Examples
• Packaging
• RFC / meta

Checklist (all PRs)

• Linked to an issue or discussion
• Scope is focused and the change is minimal
• Black and Flake8 pass
• pytest skills/ and pytest tests/ pass
• CHANGELOG.md updated
• examples/README.md updated if runnable scripts changed (not applicable: no runnable scripts changed)
• Generated registry documentation is synchronized

New or updated skill

Bundle and metadata

• Skill is located under the correct category and name
• Manifest identity, version, tags, inputs, and outputs are updated
• Optional descriptive metadata is present where applicable
• Card metadata and the frozen card fixture are synchronized

Logic, cognition, tests

• Skill.execute() returns a JSON-serializable dictionary
• The public input/output contract is documented
• Success, validation-error, no-profile, and compatibility paths are covered
• Loader discovery and manifest validation succeed
• Deterministic behavior is preserved

Documentation and catalog

• Skill catalog entry is updated
• Provider examples remain applicable; this change does not alter provider integrations
• The repository-profile standard and repository-admin responsibilities are documented
• Changelog entry describes the new v0.3 capability and compatibility boundary

Constitution and safety (skills only)

The repository profile is explicitly labelled as caller-fetched repository context. Its content cannot override the Skillware constitution, modify workflow invariants, or grant the agent authority.

This narrow version deliberately does not implement a prompt-injection firewall. Repository administrators are responsible for profile quality and for ensuring profile content is clean, sound, and conforms to the documented standard.

execute() performs no network access. Fetching ISSUE_RESOLVER.md remains the caller's responsibility, and repository-native instructions such as AGENTS.md remain independently applicable.

Related Issues

Fixes #145

[rosspeili]

@TheDarkniteFalls, solid v0.3 slice and thank you for the frozen v0.2 SHA256 regression harness. This matches the narrowed direction from #145 (parse + provenance-labelled context, no merge/firewall yet).

Before merge, please add:

1. prepare profile URLs , expose ordered repository.profile_urls (root + .github/ISSUE_RESOLVER.md) the same way we already expose readme_url / contributing_url. No fetch in execute(), caller still supplies markdown to load_repository_profile.

2. Update workflow.py, replace stale future_profiles_note (“v3 may support…”) now that v0.3 ships parsing, add an ISSUE_RESOLVER.md step/conditional under discover_repository so agents reading only stage_checklist see it.

Explicitly OK deferred for now: stage_checklist merge / profile_applied, example script wiring, injection firewall.

Once (1) and (2) land, I’m good to merge and close #145 as the narrow v0.3 ship. We can open a follow-up for smart section→stage merge if you want to pick that later.

[rosspeili]

Hey @TheDarkniteFalls LGTM <3 Thanks for the quick turnaround and the frozen regression harness. Merging this.